BitLocker Error 0x8031001D: Key Protection Required – Fix It

When This Error Shows Up

You're trying to turn on BitLocker for a drive in Windows 10 or 11, maybe an external USB drive or a secondary internal hard drive. You click Turn on BitLocker, wait a few seconds, and then get hit with:

FVE_E_KEY_REQUIRED (0x8031001D)
One or more key protection mechanisms are required for this volume.

I see this most often after someone started BitLocker encryption, stopped it partway, or moved the drive from another PC. Last month a client had this on a 2TB external drive they'd used for backups—they'd started encrypting it on an old laptop, pulled it out, and plugged it into a new one. The drive still had key protectors from the previous machine, but no encryption was actually complete.

Root Cause

BitLocker keeps track of key protectors (like a password, PIN, or recovery key) even if encryption never finished. When you try to enable encryption again, Windows sees those orphan key protectors and throws this error because it expects them to be properly applied to an already-encrypted volume. But the volume isn't encrypted—it's a mess of partial states. The fix is to clear those stale key protectors and start fresh.

The Fix: Clear Key Protectors via Command Line

Don't bother trying to toggle BitLocker settings in the GUI—it'll just keep failing. Use manage-bde from an elevated Command Prompt.

Step 1: Open Command Prompt as Admin

1. Press Windows Key + X and select Terminal (Admin) or Command Prompt (Admin).
2. Click Yes on the UAC prompt.

Step 2: Identify the Drive Letter

Run this to see all BitLocker volumes and their status:

manage-bde -status

Look for the drive letter—let's say it's E:. You'll see something like Protection On but Percentage Encrypted at 0% or partial. That's your target.

Step 3: Turn Off BitLocker and Remove Key Protectors

This command disables protection and clears all key protectors for drive E:

manage-bde -off E:

Wait for it to finish—it'll say Decryption is complete. This can take a few seconds or minutes depending on the drive size, but since encryption wasn't complete, it's usually quick.

Then confirm the protectors are gone:

manage-bde -protectors -delete E:

This nukes any leftover password, recovery key, or TPM protector. Run manage-bde -status E: again—you should now see Protection Off and no key protectors listed.

Step 4: Re-enable BitLocker from Scratch

Now go back to This PC, right-click the drive, and choose Turn on BitLocker. Set up your password or smart card like normal. It should proceed without the error.

Heads up: If this is a system drive (C: drive), you might need to suspend BitLocker instead of turning it off fully. Run manage-bde -protectors -disable C: first, then re-enable via GUI. But for data drives, the -off approach works fine.

What If It Still Fails?

If you're still getting the same error after removing protectors, check these:

• Disk is read-only: On external drives, make sure it's not physically locked or set to read-only in disk properties. Use diskpart and attributes disk clear readonly if needed.
• File system issues: Run chkdsk E: /f to fix any file system corruption. BitLocker gets twitchy on damaged volumes.
• TPM interference: On some laptops, the TPM may hold a stale protector. Go to Device Manager > Security devices, right-click Trusted Platform Module, and select Update driver > Browse my computer > Let me pick > choose the same driver and hit Next to reset it.
• Third-party encryption: If the drive ever had VeraCrypt, TrueCrypt, or hardware encryption from the drive manufacturer (like WD Security or Samsung Magician), disable that entirely. BitLocker won't play nice with other encryption.

I've never seen a case where this fix didn't work unless there was some weird hardware lock. One time a guy had a Seagate external drive with built-in AES encryption enabled by default—he had to use the Seagate Toolkit to disable it before BitLocker would even show up as an option. So if you're stuck, check that first.